Methods, devices, and computer program products for model adaptation

ABSTRACT

Embodiments of the present disclosure provide methods, devices, and computer program products for model adaptation. The method for model adaptation comprises: receiving, at a first computing device, a data set to be analyzed from a data collector and determining abnormality of the data set to be analyzed using a machine learning model deployed at the first computing device. The method further comprises transmitting, based on the determined abnormality of the data set, at least a portion of data in the data set to a second computing device, for update of the machine learning model, the second computing device having a higher computing capability than the first computing device. The method further comprises obtaining redeployment of the updated machine learning model from the second computing device.

RELATED APPLICATION(S)

The present application claims priority to Chinese Patent ApplicationNo. 201911200675.X, filed Nov. 29, 2019, and entitled “Methods, Devices,and Computer Program Products for Model Adaptation,” which isincorporated by reference herein in its entirety.

FIELD

Embodiments of the present disclosure relate to the field of dataanalysis, and more specifically to methods for model adaptation,electronic devices, and computer program products.

BACKGROUND

In recent years, with the development of computer technologies, theInternet of Things (IoT) has been increasingly applied to all aspects ofpeople's lives. A core of the IoT technology is to analyze data obtainedby IoT devices such as various temperature sensors, position sensors,imaging sensors, meters, and the like. The sensor data mayadvantageously support advanced warning, prediction, and so on forpeople. However, such sensor data is usually massive so that theresource consumption for transmission and processing of the sensor datais high. As the artificial intelligence technology develops, currentlyit has been proposed to utilize a machine learning model to provide moreaccurate data analysis. However, training and application of the machinelearning model pose new challenges to resource consumption. Therefore,the current focus is placed on how to analyze the massive sensor data inthe IoT effectively.

SUMMARY

Embodiments of the present disclosure provide a solution for modeladaptation.

In a first aspect of the present disclosure, there is provided a methodfor model adaptation. The method comprises receiving, at a firstcomputing device, a data set to be analyzed from a data collector anddetermining abnormality of the data set to be analyzed using a machinelearning model deployed at the first computing device. The methodfurther comprises transmitting, based on the determined abnormality ofthe data set, at least a portion of data in the data set to a secondcomputing device, for update of the machine learning model, the secondcomputing device having a higher computing capability than the firstcomputing device. The method further comprises obtaining redeployment ofthe updated machine learning model from the second computing device.

In a second aspect of the present disclosure, there is provided a methodfor model adaptation. The method comprises deploying, at a secondcomputing device, a trained machine learning model to a first computingdevice, the machine learning model being configured to determineabnormality of a data set to be analyzed from a data collector, and thesecond computing device having a higher computing capability than thefirst computing device; receiving at least a portion of data in the dataset from the first computing device; updating the machine learning modelbased on the received portion of data; and redeploying the updatedmachine learning model to the first computing device.

In a third aspect of the present disclosure, there is provided anelectronic device. The electronic device comprises at least oneprocessor; and at least one memory storing computer programinstructions, the at least one memory and the computer programinstructions being configured, with the at least one processor, to causethe electronic device to perform acts. The acts comprise receiving adata set to be analyzed from a data collector; determining abnormalityof the data set using a machine learning model deployed at theelectronic device; transmitting, based on the determined abnormality ofthe data set, at least a portion of data in the data set to a furtherelectronic device for update of the machine learning model, the furtherelectronic device having a higher computing capability than theelectronic device; and obtaining redeployment of the updated machinelearning model from the further electronic device.

In a fourth aspect of the present disclosure, there is provided anelectronic device. The electronic device comprises: at least oneprocessor; and at least one memory storing computer programinstructions, the at least one memory and the computer programinstructions being configured, with the at least one processor, to causethe electronic device to perform acts. The acts comprise deploying atrained machine learning model to a further electronic device, themachine learning model being configured to determine abnormality of adata set to be analyzed from a data collector, and the electronic devicehaving a higher computing capability than the further electronic device;receiving at least a portion of data in the data set from the furtherelectronic device; updating the machine learning model based on thereceived portion of data; and redeploying the updated machine learningmodel to the further electronic device.

In a fifth aspect of the present disclosure, there is provided acomputer program product. The computer program product is tangiblystored on a non-transitory computer-readable medium and comprisingcomputer-executable instructions which, when executed, cause a device toperform the method according to the above first aspect.

In a sixth aspect of the present disclosure, there is provided acomputer program product. The computer program product is tangiblystored on a non-transitory computer-readable medium and comprisingcomputer-executable instructions which, when executed, cause a device toperform the method according to the above second aspect.

The Summary is to introduce a selection of concepts in a simplified formthat are further described below in the Detailed Description. ThisSummary is not intended to identify key or essential features of thepresent disclosure, nor is it intended to be used to limit the scope ofthe present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objectives, features, and advantages of exampleembodiments of the present disclosure will become more apparent throughthe following detailed description with reference to the accompanyingdrawings, in which the same reference symbols refer to the same elementsin exemplary embodiments of the present disclosure.

FIG. 1 illustrates a schematic diagram of an environment in whichembodiments of the present disclosure can be implemented;

FIG. 2 illustrates a schematic diagram of an application environment inaccordance with some embodiments of the present disclosure;

FIG. 3 illustrates a schematic diagram of an application environmentaccording to some other embodiments of the present disclosure;

FIG. 4 illustrates a flowchart of a signaling flow for model adaptationin accordance with some embodiments of the present disclosure;

FIG. 5 illustrates a flowchart of a process for model adaptation inaccordance with some embodiments of the present disclosure;

FIG. 6 illustrates a flowchart of a process for model adaptation inaccordance with some embodiments of the present disclosure; and

FIG. 7 illustrates a block diagram of an example device that can be usedto implement the embodiments of the present disclosure.

DETAILED DESCRIPTION

Principles of the present disclosure will now be described below withreference to several example embodiments shown in the accompanyingdrawings. Although some preferred embodiments of the present disclosureare shown in the accompanying drawings, it is to be appreciated thatthese embodiments are described only to enable those skilled in the artto better understand and practice the present disclosure, withoutsuggesting any limitation to the scope of the present disclosure in anyway.

As used herein, the term “includes” and its variants are to be read asopen-ended terms that mean “includes, but is not limited to.” The term“or” is to be read as “and/or” unless the context clearly indicatesotherwise. The term “based on” is to be read as “based at least in parton.” The term “one example implementation” and “an exampleimplementation” are to be read as “at least one example implementation.”The term “another implementation” is to be read as “at least one furtherimplementation.” The terms “a first,” “a second” and others may denotedifferent or the same objects. Other definitions, either explicit orimplicit, may be included below.

As used herein, “machine learning” refers to processing involvinghigh-performance computing, machine learning, and artificialintelligence algorithms. As used herein, the term “machine learningmodel” may also be referred to as “learning model,” “learning network,”“network model” or “model.” A “neural network” or “neural network model”is a deep machine learning model. Generally speaking, a machine learningmodel receives input information and performs prediction based on theinput information.

Machine learning is illustratively divided into three phases, includinga training phase, a test phase, and an application phase. In thetraining phase, a provided machine learning model may be trained using alarge amount of training samples, and the training is iteratedconstantly until the machine learning model may obtain, from thetraining samples, an ability to make consistent inferences similar tothat of human intelligence. Through training, the machine training modelmay be capable of learning a mapping or association relationship betweenthe input and the output from the training data. Through the training,parameter set values of the machine learning model are determined.During the test phase, the test samples can be used to test the trainedmachine learning model to determine the performance of the machinelearning model. In the application phase, the machine learning model canbe used to process real-life input information based on the parameterset values obtained from the training to provide the correspondingoutput.

FIG. 1 illustrates a schematic diagram of an environment 100 in whichembodiments of the present disclosure can be implemented. As shown inFIG. 1, the environment 100 includes one or more data collectors 105-1,105-2, . . . , 105-N (collectively or individually referred to as datacollectors 105, where N is a positive integer greater than or equal to1), a computing device 120, cloud computing architecture 130, and acomputing device 140 provided in the cloud computing architecture 130.The environment 100 may be considered as the Internet of Things (IoT).It is to be appreciated that the number and arrangement of the devicesshown in FIG. 1 are only for purpose of illustration and should not beconsidered as limitations to the claimed subject matter.

In some embodiments, the computing device 120 may be an edge computingnode, such as a computing node having a gateway function (also referredto as an edge gateway). The computing device 120 may be in a wired orwireless connection and communicate with one or more data collectors105. The computing device 120 may be configured to receive data set110-1, data set 110-2, . . . , data set 110-N to be analyzed(collectively or individually referred to as data set 110) from the oneor more data collectors 105. The analysis operation of the data set 110may be implemented by a device with a computing capability in theenvironment 100.

The data collectors 105 may be any devices capable of collecting data,for example, various types of sensors. Examples of the data collectors105 include an imaging sensor, a motion sensor, a temperature sensor, aposition sensor, an illumination sensor, a humidity sensor, a powersensor, a gas sensor, a smoke sensor, a humidity sensor, a pressuresensor, a positioning sensor, an accelerometer, and a gyroscope, ameter, a sound decibel sensor, and the like. During data analysis, itmight be necessary to perform data anomaly detection on the data set110, so as to discover anomaly events occurring in the environment inwhich the data collectors 105 are deployed and provide alerts of theanomaly events to facilitate determination of subsequent measures.

The cloud computing architecture 130 is remotely arranged to providecomputation, software, data access, and storage services. The processingin the cloud computing architecture 130 may be referred to as “cloudcomputation.” In various implementations, the cloud computation providesservices over a wide area network such as the Internet using anappropriate protocol. For example, providers of the cloud computingarchitecture 130 provision applications over the wide area network whichcan be accessed through a web browser or any other computing components.Software or components of the cloud computing architecture 130 andcorresponding data may be stored on servers at a remote location. Thecomputing resources in the cloud computing architecture 130 may beaggregated at a remote data center location or can be disaggregated.Cloud computing infrastructures can deliver services through a shareddata center although they can act as individual access points for users.Thus, the components and functions described herein can be provided froma service provider at a remote location using the cloud computingarchitecture 130. Alternatively, they can be provided from conventionalservers, or can be installed on client devices directly or in any of avariety of other manners. Although illustrated as a single device, it isto be appreciated that the computing device 140 may be any componentthat is in the cloud computing architecture 130 and has a computingcapability. Accordingly, various portions of the computing device 140may be distributed across the cloud computing architecture 130.

A current trend is to implement data analysis and anomaly detectionusing the machine learning model. Anomaly detection of data may beconsidered as a classification problem to be solved by the machinelearning model. The training and application of the machine learningmodel need the support of computing resources such as those forprocessing and storage. In order to achieve the required processingaccuracy or depending on the type of model used, the size of the machinelearning model may be large, thereby having higher requirements forcomputing resources.

In practical application, the requirements and criteria for dataanalysis and the data collected from data sources (e.g., from datacollectors) may change over time. For example, it may be desired tofirst determine roughly whether the data is abnormal data and then tomore precisely determine a more refined type of the abnormal data and/orthe normal data. The number of the data collectors may also be increasedor decreased, resulting in changes in the types and amounts of data tobe processed. Therefore, another challenge in training and applicationof a machine learning model is how the model evolves. However, ascompared with the application of the machine learning model, thetraining of the model consumes more resources and takes a longer periodof time to complete.

In view of the above, if update and application of a machine learningmodel are deployed in the cloud computing architecture with a highercomputing capability, the computing resource may not be the issue.However, such deployment may have an impact on the real-time response ofthe data analysis because a large latency may be introduced intransmission of data to be analyzed from data collectors to the cloudcomputing architecture and feedback of an analysis result from the cloudcomputing architecture, thereby failing to satisfy the requirement inreal-time data anomaly detection. For example, in a scenario where aspeed sensor is used to detect a running state of a vehicle, it isimportant to quickly detect an abnormal speed to predict a possible caraccident.

In another possible implementation, if both the update and theapplication of the machine learning model are deployed in a computingdevice closer to the data sources, such as an edge computing node in theIoT, the latency of anomaly detection may be decreased by consumingcomputing resources of the edge computing node. This may lead to lowerefficiency in both the update and the application of the model.

In accordance with embodiments of the present disclosure, a solution formodel adaptation is proposed. In this solution, application and updateof a machine learning model are distributed to different computingdevices to implement. Specifically, the machine learning model isdeployed on a first computing device which is configured to process adata set to be analyzed from a data collector. According to a processingresult of the data set, the first computing device provides at least aportion of data in the data set to a second computing device. The secondcomputing device is configured to update the machine learning model atleast based on the data from the first computing device and redeploy theupdated machine learning model to the first computing device. In thisway, the machine learning model of the current version can be used toprovide a data analysis result, meanwhile the model update can beimplemented using other computing devices with a higher computingcapability, which enables the model to be adapted over time.

FIG. 2 illustrates a schematic diagram of an application environment inaccordance with some embodiments of the present disclosure. An exampleenvironment for distributed application and update of a model isillustrated according to embodiments of the present disclosure. Asshown, a trained machine learning model 210 is deployed at the computingdevice 120. The computing device 140, which has a higher computingcapability, comprises a model training module 220 configured for updateof the machine learning model 210.

The computing device 140 may save the machine learning model 210 thathas been currently deployed at the computing device 120 and then updatethe machine learning model 210 according to a model update rule. Asshown in FIG. 3, the computing device 140 redeploys the updated machinelearning model (referred to as a machine learning model 310) to thecomputing device 120. As such, the computing device 120 may use the newmachine learning model 310 to process the data set 110 from the datacollector 105.

FIG. 4 illustrates a signaling flow 400 for model adaptation inaccordance with some embodiments of the present disclosure. Thesignaling flow 400 involves the computing device 120, the computingdevice 140, and the data collector(s) 105. For purpose of discussion,the signaling flow 400 will be discussed with reference to FIG. 2 andFIG. 3.

The computing device 140 may be a device with a higher computingcapability and thus may be used to implement model training. Thecomputing device 140 deploys 410 a trained machine learning model 210 tothe computing device 120. For example, the computing device 140 maysend, to the computing device 120, configuration data of the machinelearning model 210 and the values in the parameter set determined fromthe training.

The machine learning model 210 is configured and trained to be able todetect anomalies in the data. Data anomaly detection may be known as aclassification task such as a two-class task (for example, determiningwhether the data is normal or abnormal) or a multi-class task (forexample, determining which type of abnormal data or which type of normaldata to which the data belongs). The machine learning model 210 may beconfigured as any type of model that is capable of implementing the dataanomaly detection. Some examples of the machine learning model 210include a Support Vector Machine (SVM) model, a Bayesian model, a randomforest model, and various deep learning/neural network models such asConvolutional Neural Network (CNN), Recurrent Neural Network (RNN), andthe like. In some embodiments, the configuration of the machine learningmodel 210 also depends on the type of the data to be analyzed (e.g., thedata set 110 from the data collector(s) 105). In some examples, themachine learning model 210 may comprise a plurality of sub-models toprocess different types of data.

The machine learning model 210 may be trained based on training data. Inthe initial phase, the training data of the machine learning model 210may be obtained from training data in databases. Model training may begenerally divided into supervised and unsupervised learning. In thesupervised learning, training input data and one or more labels of thetraining input data are used for training. Both the training input dataand the label(s) are referred to as the training data of the machinelearning model 210. The form of the training input data is input datasupported by the machine learning model 210.

During the training, for each of one or more iterations, the machinelearning model 210 processes the training input data based on theparameter values of the current parameter set, and provides the modeloutput based on the current parameter set. The computing device 140, forexample, the model training module 220 in the computing device 140,compares the model output with a label to determine whether the value ofthe parameter set of the machine learning model 210 is correct. Forexample, if the result of the comparison indicates that the differenceis relatively large, the model training module 220 will continue toadjust the value of the parameter set. After certain convergenceconditions are satisfied, the training of the machine learning model 210is completed. In unsupervised learning, a label will not be needed, andthe machine learning model 210 analyzes modes possibly occurring in thetraining input data to complete the training. It is to be appreciatedthat the above is only a brief introduction to model training. The modeltraining module 220 of the computing device 140 may use various trainingalgorithms to train the machine learning model 210.

In some embodiments, after the training of the machine learning model210 is completed, it is possible to continue to use known testing datato test the trained machine learning model 210 to determine theperformance of the machine learning model. The testing phase may also becompleted by the computing device 140.

After obtaining the deployment of the machine learning model 210 fromthe computing device 140, the computing device 120 may use the machinelearning model 210 to perform a corresponding data analysis task,especially the task of data anomaly detection. Specifically, thecomputing device 120 receives 415 a data set to be analyzed, such as adata set 110 to be analyzed, from one or more data collectors 105. Thedata collector(s) 105 may be configured to send the data to thecomputing device 120 periodically or intermittently, depending on aconfiguration of each data collector 105. The data collector(s) 105 mayprovide the data set 110 to the computing device 120 via a wiredcommunication connection and/or a wireless communication connection.

The computing device 120 determines 420 abnormality of the data set 110using the deployed machine learning model 210. The computing device 120is an edge device whose speed of communication with the data collector105 is usually higher than a communication speed between the datacollector 105 and the computing device 140. Therefore, the data anomalydetection at the computing device 120 can improve the detection speedand provide a rapid response to the anomaly detection.

The data set 110 to be analyzed may, for example, be used as an input tothe machine learning model 210 after pre-processing. If the machinelearning model 210 comprises a plurality of sub-models, different dataportions in the data set 110 may be provided to respective sub-modelsfor processing. Generally, the machine learning model 210 can detectwhether data in the data set 110 is abnormal. The criteria for dataanomaly detection may be learned from the training data by the machinelearning model 210 during the training phase, and the classificationcriteria for data anomaly may be configured by developers. For example,in an example of detecting an ambient temperature with a temperaturesensor, whether there is a temperature anomaly event is determined basedon whether currently collected temperature data is higher than a certainthreshold or lower than a certain threshold. Data anomaly detection mayhelp provide an alert for abnormal events. For example, an alert for atemperature anomaly event may be provided so that an engineer mayconfirm whether the temperature sensor has failed or whether there is arisk of data intrusion, for example, data tampering.

After determining the abnormality of the data set 110 using the machinelearning model 210, the computing device 120 transmits 425 at least aportion of data in the data set 110 to the computing device 140 based onthe determined abnormality of the data set 110, for use in updating ofthe machine learning model 210. The computing device 140 may, forexample, be included in the cloud computing architecture 130 in theexamples of FIG. 2 and FIG. 3. Therefore, the computing device 140 has ahigher computing capability than the computing device 120, and the modelupdating process, which may consume more computing resources and moretime, can be implemented by the computing device 140. In this way, notonly the accuracy of the model update is ensured, but also the resourcesof the computing device 120 can be saved. Thus, the computing device 120may focus on the data anomaly detection. Sometimes it may even bepossible to achieve parallel implementation of the model update and thedata anomaly detection, thereby further improving the efficiency.

The update of the machine learning model 210 may comprise retraining ofthe previous version of the machine learning model 210, so that thevalues in the parameter set of the machine learning model 210 may befine-tuned to provide a more accurate output result, e.g., more accuratedetection of abnormality of the data from the data collector(s) 105.Alternatively, the update of the machine learning model 210 furthercomprises updating the model configuration of the machine learning model210, for example, changing the architecture of the model, including thenumber of hidden nodes in the model, the number of network layers, thenumber of nodes in an output layer, and the like, or configuring anothertype of machine learning model. For example, the machine learning model210 may be configured to determine the data as abnormal or normal. Themachine learning model with a new configuration may divide the data intoa finer class, such as one of multiple abnormal types and one ofmultiple normal types.

In some embodiments, the data provided to the computing device 120 forupdating the model may be that data determined by the machine learningmodel 210 to be normal data in the data set 110. As for the datadetermined to be abnormal in the data set 110, after an indication ofanomaly of this portion of data is provided, the computing device 120may discard this portion of data without using those data to furtherupdate the model.

Considering the classification, a data sample may be determined aspositive or negative. For a two-class classification issue, there may befour cases. If a data sample is positive and is also predicted aspositive by the machine learning model, this data sample may be referredto as a true positive data sample. If the positive data sample isincorrectly predicted as negative by the machine learning model, it maybe referred to as a false negative data sample. If a data sample isnegative but determined as positive by the machine learning model, thedata sample is referred to as a false positive data sample. Otherwise,if the data sample is correctly predicted as negative by the machinelearning model, it is referred to as a true negative data sample.

In the embodiments of data anomaly detection, it is assumed thatabnormal data are classified as negative data samples and normal dataare classified as a positive data samples. If the machine learning model210 currently used by the computing device 120 can determine a portionof data in the data set 110 as abnormal data, the prediction of thisportion of data by the machine learning model 210 may be consideredcorrect because there are further subsequent processes for furtherdetection and processing of the abnormal data during the data anomalydetection. Therefore, the data determined as abnormal in the data set110 may be regarded as “true negative data” and may not be used toimprove the detection accuracy of this portion of data by the model.Accordingly, the computing device 120 may not need to provide thisportion of data to the computing device 140. If the currently-usedmachine learning model 210 predicts a portion of data in the data set110 as normal data, this portion of data may be true positive data orfalse positive data, that is, the machine learning model 210 may or maynot perform the prediction incorrectly. This portion of data is providedto the computing device 140 for the model update, which allows the modelto be updated in such a way that abnormality of data similar to thisportion of data can be detected more accurately.

The computing device 120 may continuously process the data to beanalyzed from the data collector(s) 105 using the currently-deployedmachine learning model 210 and provide the portion(s) of data determinedto be normal to the computing device 140. After receiving 430 at least aportion of data in the data set 110 from the computing device 120, thecomputing device 140, for example, the model training module 220 in thecomputing device 140, updates 435 the machine learning model 210 basedon the received data.

In some embodiments, the computing device 140 may store the portion ofdata received and start the model update process after the received datais accumulated to a certain amount. In some embodiments, in addition toobtaining the data for model update from the computing device 120, thecomputing device 140 may further obtain additional data for the modelupdate from one or more other data sources. In one embodiment, if themodel is updated in a supervised learning manner, the computing device140 may further obtain one or more labels related to the data receivedfrom the computing device 120, with the one or more labels indicatingwhether the data is normal or abnormal. The computing device 140 mayupdate the machine learning model 210 based on the data received fromthe computing device 120 and the label(s) associated with the data. Thelabel(s) of the data may be obtained, for example, through manuallabeling. As mentioned above, the update of the machine learning model210 may, for example, include re-determining the values in the parameterset on the basis of the original configuration of the machine learningmodel 210, or determining values in a parameter set of a new machinelearning model after changing or replacing the configuration of themachine learning model 210 with that of the new machine learning model.The update of the model is a process of model retraining, the details ofwhich can refer to the above description of the model training.

After the training, the computing device 140 obtains the updated machinelearning model, that is, the machine learning model 310. The computingdevice 140 redeploys 440 the machine learning model 310 to the computingdevice 120. Thus, the model used by the computing device 120 for dataanomaly detection may evolve from the original machine learning model210 to the new machine learning model 310. The computing device 120 mayuse the machine learning model 310 to perform the anomaly detection onthe data set to be analyzed from the data collector(s) 105. The newmachine learning model 310 after the evolution can provide a moreaccurate detection result.

FIG. 5 shows a flowchart of a process 500 for model adaptation inaccordance with some embodiments of the present disclosure. The process500 may be performed by the computing device 120 of FIG. 1 and may beimplemented in the example environment of FIG. 2 and FIG. 4.

At 510, the computing device 120 (sometimes also referred to as a firstcomputing device) receives a data set to be analyzed from a datacollector. At 520, the computing device 120 determines abnormality ofthe data set using a machine learning model deployed at the computingdevice 120. At 530, the computing device 120 transmits, based on thedetermined abnormality of the data set, at least a portion of data inthe data set to a computing device 140 (sometimes also referred to as asecond computing device) for update of the machine learning model. Thecomputing device 140 has a higher computing capability than thecomputing device 120. At 540, the computing device 120 obtainsredeployment of the updated machine learning model from the computingdevice 140.

In some embodiments, a communication speed between the computing device120 and the data collector is higher than a communication speed betweenthe computing device 140 and the data collector.

In some embodiments, transmitting at least a portion of data in the dataset to the computing device 140 comprises: providing data determined tobe normal in the data set to the computing device 140.

In some embodiments, the process 500 further comprises: discarding datadetermined to be abnormal in the data set after an indication of theabnormality of the data in the data set is provided.

In some embodiments, the computing device 120 comprises an edgecomputing node. In some embodiments, the computing device 140 isimplemented in a cloud computing architecture. In some embodiments, thedata collector comprises one or more IoT sensors or other IoT devices.

FIG. 6 shows a flowchart of a process 600 for model adaptation inaccordance with some embodiments of the present disclosure. The process600 may be performed by the computing device 140 of FIG. 1 and may beimplemented in the example environment of FIG. 2 and FIG. 4.

At 610, the computing device 140 deploys a trained machine learningmodel to a computing device 120. The machine learning model isconfigured to determine abnormality of a data set to be analyzed from adata collector. The computing device 140 has a higher computingcapability than the computing device 120. At 620, the computing device140 receives at least a portion of data in the data set from thecomputing device 120. At 630, the computing device 140 updates themachine learning model based on the received portion of data. At 640,the computing device 140 redeploys the updated machine learning model tothe computing device 120.

In some embodiments, receiving at least a portion of data in the dataset to be analyzed comprises: receiving from the computing device 120,at least a portion of data determined to be normal by the machinelearning model in the data set.

In some embodiments, updating the machine learning model comprises:obtaining a label related to the received data, the label indicatingwhether the portion of data is normal or abnormal; and updating themachine learning model based on the received portion of data and thelabel.

In some embodiments, a communication speed between the computing device120 and the data collector is higher than a communication speed betweenthe computing device 140 and the data collector.

In some embodiments, the computing device 120 comprises an edgecomputing node. In some embodiments, the computing device 140 isimplemented in a cloud computing architecture. In some embodiments, thedata collector comprises at least one IoT sensor or other IoT device.

FIG. 7 illustrates a block diagram of an example device 700 that can beused to implement the embodiments of the present disclosure. The device700 can be used to implement the process 500 in FIG. 5 or the process600 of FIG. 6. The device 700 may be implemented as the computing device120 or the computing device 140 in FIG. 1.

As shown, the device 700 comprises a central processing unit (CPU) 701,which can perform various acts and processes according to computerprogram instructions stored in a read-only memory (ROM) 702 or loaded toa random-access memory (RAM) 703 from a storage unit 708. The RAM 703can also store various programs and data required by the operations ofthe device 700. The CPU 701, ROM 702, and RAM 703 are connected to eachother via a bus 704. An input/output (I/O) interface 705 is alsoconnected to the bus 704.

The following components in the device 700 are connected to the I/Ointerface 705: an input unit 706 such as a keyboard, a mouse, or thelike; an output unit 707 such as various types of displays and speakers;a storage unit 708 such as a magnetic disk or optical disk; and acommunication unit 709 such as a network card, a modem, a wirelesscommunication transceiver or the like. The communication unit 709enables the device 700 to exchange information/data with other devicesvia a computer network such as the Internet and/or varioustelecommunication networks.

Various methods and processes described above, such as the process 500or the process 600, can also be performed by the processing unit 701. Insome embodiments, the process 500 or the process 600 can be implementedas a computer software program or a computer program product tangiblycomprised in a machine-readable medium, such as a non-transitorycomputer-readable medium, for example the storage unit 708. In someembodiments, the computer program can be partially or fully loadedand/or mounted to the device 700 via the ROM 702 and/or thecommunication unit 709. When the computer program is loaded to the RAM703 and executed by the CPU 701, one or more steps of the process 500 orthe process 600 described above can be implemented. Alternatively, theCPU 701 can be configured via any other suitable manner (e.g., by meansof firmware) to perform the process 500 or the process 600 in otherembodiments.

It is to be understood by those skilled in the art that the above stepsof the methods of the present disclosure may be implemented by ageneral-purpose computing device(s), being integrated on a singlecomputing device or distributed on a network comprising multiplecomputing devices. Alternatively, the above steps of the methods may beimplemented with program code executable by a computing device, so thatthey may be stored in a storage device and executed by the computingdevice, or may be fabricated as individual integrated circuit modules,respectively, or multiple modules or steps may be fabricated asindividual integrated circuit modules for implementation. As such, thepresent disclosure is not limited to any particular combination ofhardware and software.

It is to be appreciated that although several means or sub-means of thedevice are mentioned in the detailed description above, this division ismerely exemplary, not mandatory. In fact, in accordance with embodimentsof the present disclosure, the features and functions of the two or moredevices described above may be embodied in one device. On the otherhand, the features and functions of one device described above may befurther divided and embodied by a plurality of devices.

Illustrative embodiments of the present disclosure are described above,and are not intended to limit the present disclosure. For those skilledin the art, the present disclosure may have various modifications andchanges. Any modification, equivalent replacements, and improvement madewithin the spirit and principle of this disclosure should be comprisedin the scope of the present disclosure.

What is claimed is:
 1. A method for model adaptation, comprising:receiving, at a first computing device, a data set to be analyzed from adata collector; determining abnormality of the data set using a machinelearning model deployed at the first computing device; transmitting,based on the determined abnormality of the data set, at least a portionof data in the data set to a second computing device for update of themachine learning model, the second computing device having a highercomputing capability than the first computing device; and obtainingredeployment of the updated machine learning model from the secondcomputing device; wherein the first computing device comprises an edgecomputing node; and wherein the second computing device comprises acloud computing device.
 2. The method of claim 1, wherein acommunication speed between the first computing device and the datacollector is higher than a communication speed between the secondcomputing device and the data collector.
 3. The method of claim 1,wherein transmitting at least a portion of data in the data set to thesecond computing device comprises: providing data determined to benormal in the data set to the second computing device.
 4. The method ofclaim 1, further comprising: after an indication of the abnormality ofthe data in the data set is provided, discarding data determined to beabnormal in the data set.
 5. The method of claim 1, wherein the datacollector comprises at least one Internet of Things (IoT) device.
 6. Amethod for model adaptation, comprising: deploying a trained machinelearning model to a first computing device, by a second computingdevice, the machine learning model being configured to determineabnormality of a data set to be analyzed from a data collector, and thesecond computing device having a higher computing capability than thefirst computing device; receiving at least a portion of data in the dataset from the first computing device; updating the machine learning modelbased on the received portion of data; and redeploying the updatedmachine learning model to the first computing device; wherein the firstcomputing device comprises an edge computing node; and wherein thesecond computing device comprises a cloud computing device.
 7. Themethod of claim 6, wherein receiving at least a portion of data in thedata set comprises: receiving, from the first computing device, at leasta portion of data determined to be normal by the machine learning modelin the data set.
 8. The method of claim 7, wherein updating the machinelearning model comprises: obtaining a label related to the receivedportion of data, the label indicating whether the portion of data isnormal or abnormal; and updating the machine learning model based on thereceived portion of data and the label.
 9. The method of claim 6,wherein a communication speed between the first computing device and thedata collector is higher than a communication speed between the secondcomputing device and the data collector.
 10. The method of claim 6,wherein the data collector comprises at least one Internet of Things(IoT) device.
 11. An apparatus comprising at least one of a firstelectronic device and a second electronic device, the first electronicdevice comprising: at least one processor; and at least one memorystoring computer program instructions, the at least one memory and thecomputer program instructions being configured, with the at least oneprocessor, to cause the first electronic device to perform actscomprising: receiving a data set to be analyzed from a data collector;determining abnormality of the data set using a machine learning modeldeployed at the first electronic device; transmitting, based on thedetermined abnormality of the data set, at least a portion of data inthe data set to a second electronic device for update of the machinelearning model, the second electronic device having a higher computingcapability than the first electronic device; and obtaining redeploymentof the updated machine learning model from the second electronic device;wherein the first electronic device comprises an edge computing node;and wherein the second electronic device comprises a cloud computingdevice.
 12. The apparatus of claim 11, wherein a communication speedbetween the first electronic device and the data collector is higherthan a communication speed between the second electronic device and thedata collector.
 13. The apparatus of claim 11, wherein transmitting atleast a portion of data in the data set to the second electronic devicecomprises: providing data determined to be normal in the data set to thesecond electronic device.
 14. The apparatus of claim 11, wherein theacts further comprise: after an indication of the abnormality of thedata in the data set is provided, discarding data determined to beabnormal in the data set.
 15. The apparatus of claim 11, wherein thedata collector comprises at least one Internet of Things (IoT) device.16. The apparatus of claim 11, wherein the second electronic devicecomprises: at least one processor; and at least one memory storingcomputer program instructions, the at least one memory and the computerprogram instructions being configured, with the at least one processor,to cause the second electronic device to perform acts comprising:deploying the machine learning model to the first electronic device;receiving at least a portion of data in the data set from the firstelectronic device; updating the machine learning model based on thereceived portion of data; and redeploying the updated machine learningmodel to the first electronic device.
 17. The apparatus of claim 16,wherein receiving at least a portion of data in the data set comprises:receiving, from the first electronic device, at least a portion of datadetermined to be normal by the machine learning model in the data set.18. The apparatus of claim 17, wherein updating the machine learningmodel comprises: obtaining a label related to the received portion ofdata, the label indicating whether the portion of data is normal orabnormal; and updating the machine learning model based on the receivedportion of data and the label.
 19. A computer program product beingtangibly stored on a non-transitory computer-readable medium andcomprising computer-executable instructions which, when executed, causea device to perform the method of claim
 1. 20. A computer programproduct being tangibly stored on a non-transitory computer-readablemedium and comprising computer-executable instructions which, whenexecuted, cause a device to perform the method of claim 6.